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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

The attached report presents the results of the U.S. Customs and Border Protection's 
financial statement audits for fiscal years (FY) 2009 and 2008. We contracted with the 
independent public accounting firm KPMG LLP to perform the audits. The contract 
required that KPMG LLP perform its audits according to generally accepted government 
auditing standards and guidance from the Office of Management and Budget and the 
Government Accountability Office. KPMG LLP concluded that the U.S. Customs and 
Border Protection's consolidated financial statements as of and for the years ended 
September 30, 2009 and 2008, are presented fairly, in all material respects, in conformity 
with U.S. generally accepted accounting principles. The FY 2009 auditors' report 
discusses three material weaknesses and three significant deficiencies in internal control. 
KPMG LLP is responsible for the attached auditors' report, and the conclusions 
expressed in the report. We do not express opinions on the U.S. Customs and Border 
Protection's financial statements or provide conclusions on compliance with laws and 
regulations. 

The recommendations herein have been discussed in draft with those responsible for 
implementation. We trust this report will result in more effective, efficient, and 
economical operations. We express our appreciation to all of those who contributed to 
the preparation of this report. 




Richard L. Skinner 
Inspector General 



KPMG LLP 

2001 M Street, NW 
Washington, DC 20036 



Independent Auditors' Report 

Inspector General 

U.S. Department of Homeland Security: 
Commissioner 

U.S. Customs and Border Protection: 

We have audited the accompanying consolidated balance sheets of the U.S. Customs and Border Protection 
(CBP), a Component of the U.S. Department of Homeland Security (the Department), as of September 30, 
2009 and 2008, and the related consolidated statements of net cost, changes in net position, custodial 
activity, and combined statements of budgetary resources (hereinafter referred to as "consolidated financial 
statements") for the years then ended. The objective of our audits was to express an opinion on the fair 
presentation of these consolidated financial statements. In connection with our fiscal year 2009 audit, we 
also considered CBP's internal control over financial reporting and tested CBP's compliance with certain 
provisions of applicable laws, regulations, and contracts that could have a direct and material effect on 
these consolidated financial statements. 

Summary 

As stated in our opinion on the consolidated financial statements, we concluded that CBP's consolidated 
financial statements as of and for the years ended September 30, 2009 and 2008, are presented fairly, in all 
material respects, in conformity with U.S. generally accepted accounting principles. 

Our consideration of internal control over financial reporting resulted in identifying certain deficiencies 
that we consider to be material weaknesses, item letters A, B, and C, and other deficiencies that we 
consider to be significant deficiencies, item letters D, E, and F, as follows: 

A. Financial Reporting 

B. Property, Plant, and Equipment (PP&E) 

1. Secure Border Initiative 

2. Improper Settlement of Assets from Construction in Progress 

3. Management Oversight of PP&E and Transactions 

C. Drawback of Duties, Taxes, and Fees 

D. Inactive Obligations 

E. Entry Process 

1. In-Bond Program 

2. Entry Summary Compliance Measurement 

3. Bonded Warehouse and Foreign Trade Zones 

F. Information Technology 

The results of our tests of compliance with certain provisions of laws, regulations, and contracts disclosed 
no instances of noncompliance or other matters that are required to be reported herein under Government 
Auditing Standards and Office of Management and Budget (OMB) Bulletin No. 07-04, Audit Requirements 
for Federal Financial Statements, as amended. 




KPMG LLP. a U.S. limited liability partnership, is the U.S. 
member firm of KPMG International, a Swiss cooperative. 



The following sections discuss our opinion on CBP's consolidated financial statements; our consideration 
of CBP's internal control over financial reporting; our tests of CBP's compliance with certain provisions of 
applicable laws, regulations, and contracts; and management's and our responsibilities. 

Opinion on the Financial Statements 

We have audited the accompanying consolidated balance sheets of the U.S. Customs and Border Protection 
(CBP), a component of the U.S. Department of Homeland Security (the Department) as of September 30, 
2009 and 2008, and the related consolidated statements of net cost, changes in net position, and custodial 
activity, and the combined statements of budgetary resources for the years then ended. 

In our opinion, the consolidated financial statements referred to above present fairly, in all material 
respects, the financial position of CBP as of September 30, 2009 and 2008, and its net costs, changes in net 
position, custodial activity, and budgetary resources for the years then ended, in conformity with U.S. 
generally accepted accounting principles. 

As discussed in Notes 19 and 20 to the consolidated financial statements, CBP changed its method of 
presenting its cost programs in fiscal year 2009 to align with the Department's new goals per the 2008- 
2013 DHS Strategic Plan. As such, the fiscal year 2009 consolidated statement of net cost and related note 
disclosures are not comparable to the fiscal year 2008 consolidated statement of net cost and related note 
disclosures. 

The information in the Management's Discussion and Analysis and Required Supplementary Information 
(RSI) sections is not a required part of the consolidated financial statements, but is supplementary 
information required by U.S. generally accepted accounting principles. We have applied certain limited 
procedures, which consisted principally of inquiries of management regarding the methods of measurement 
and presentation of this information. However, we did not audit this information and, accordingly, we 
express no opinion on it. As a result of such limited procedures, we believe that the RSI is not in 
conformity with accounting standards because the RSI presents the Statement of Budgetary Resources by 
major fund type instead of by major budget account. 

The information in the Commissioner's Message, Performance Section, Message from the Chief Financial 
Officer, Other Accompanying Information, Office of Inspector General (OIG) Report on Major 
Management Challenges, and Acronyms, as reflected in the Performance and Accountability Report Fiscal 
Year 2009 's accompanying table of contents are presented for purposes of additional analysis and are not 
required as part of the consolidated financial statements. This information has not been subjected to 
auditing procedures and, accordingly, we express no opinion on it. 

Internal Control Over Financial Reporting 

Our consideration of the internal control over financial reporting was for the limited purpose described in 
the Responsibilities section of this report and was not designed to identify all deficiencies in the internal 
control over financial reporting that might be deficiencies, significant deficiencies, or material weaknesses. 

A deficiency in internal control exists when the design or operation of a control does not allow 
management or employees, in the normal course of performing their assigned functions, to prevent, or 
detect and correct misstatements on a timely basis. A significant deficiency is a deficiency, or a 
combination of deficiencies, in internal control that is less severe than a material weakness, yet important 
enough to merit attention by those charged with governance. A material weakness is a deficiency, or 
combination of deficiencies, in internal control, such that there is a reasonable possibility that a material 
misstatement of the entity's financial statements will not be prevented, or detected and corrected on a 
timely basis. 



In our fiscal year 2009 audit, we identified certain deficiencies in internal control over financial reporting 
that we consider to be material weaknesses, described in Exhibit I, and other deficiencies that we consider 
to be significant deficiencies, described in Exhibit II. Exhibit III presents the status of prior year material 
weaknesses and significant deficiencies. We also noted certain additional deficiencies involving internal 
control over financial reporting and its operation that we will report to the management of CBP in a 
separate letter. 

Compliance and Other Matters 

The results of our tests of compliance as described in the Responsibilities section of this report disclosed no 
instances of noncompliance or other matters that are required to be reported herein under Government 
Auditing Standards or OMB Bulletin No. 07-04. 

Responsibilities 

Management's Responsibilities. Management is responsible for the consolidated financial statements; 
establishing and maintaining effective internal control; and complying with laws, regulations, and contracts 
applicable to CBP. 

Auditors' Responsibilities. Our responsibility is to express an opinion on the fiscal year 2009 and 2008 
consolidated financial statements of CBP based on our audits. We conducted our audits in accordance with 
auditing standards generally accepted in the United States of America; the standards applicable to financial 
audits contained in Government Auditing Standards, issued by the Comptroller General of the United 
States; and OMB Bulletin No. 07-04. Those standards and OMB Bulletin No. 07-04 require that we plan 
and perform the audits to obtain reasonable assurance about whether the consolidated financial statements 
are free of material misstatement. An audit includes consideration of internal control over financial 
reporting as a basis for designing audit procedures that are appropriate in the circumstances, but not for the 
purpose of expressing an opinion on the effectiveness of CBP's internal control over financial reporting. 
Accordingly, we express no such opinion. 

An audit also includes: 

• Examining, on a test basis, evidence supporting the amounts and disclosures in the consolidated 
financial statements; 

• Assessing the accounting principles used and significant estimates made by management; and 

• Evaluating the overall consolidated financial statement presentation. 
We believe that our audits provide a reasonable basis for our opinion. 

In planning and performing our fiscal year 2009 audit, we considered CBP's internal control over financial 
reporting by obtaining an understanding of CBP's internal control, determining whether internal controls 
had been placed in operation, assessing control risk, and performing tests of controls as a basis for 
designing our auditing procedures for the purpose of expressing our opinion on the consolidated financial 
statements. We did not test all controls relevant to operating objectives as broadly defined by the Federal 
Managers' Financial Integrity Act of 1982. The objective of our audit was not to express an opinion on the 
effectiveness of CBP's internal control over financial reporting. Accordingly, we do not express an opinion 
on the effectiveness of CBP's internal control over financial reporting. 



As part of obtaining reasonable assurance about whether CBP's fiscal year 2009 consolidated financial 
statements are free of material misstatement, we performed tests of CBP's compliance with certain 
provisions of laws, regulations, and contracts, noncompliance with which could have a direct and material 
effect on the determination of the consolidated financial statement amounts, and certain provisions of other 
laws and regulations specified in OMB Bulletin No. 07-04. We limited our tests of compliance to the 
provisions described in the preceding sentence, and we did not test compliance with all laws, regulations, 
and contracts applicable to CBP. However, providing an opinion on compliance with laws, regulations, and 
contracts was not an objective of our audit and, accordingly, we do not express such an opinion. 



CBP's response to the findings identified in our audit are presented in Management's Response to the 
Independent Auditor's Report. We did not audit CBP's response and, accordingly, we express no opinion 
on it. 

This report is intended solely for the information and use of CBP's management, DHS' management, the 
DHS' Office of Inspector General, OMB, the U.S. Government Accountability Office, and the U.S. 
Congress, and is not intended to be and should not be used by anyone other than these specified parties. 

January 6, 2010 
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Material Weaknesses 
A. Financial Reporting 
Background: 

In recent years, CBP's operations and capital expenditures have increased substantially, particularly along 
the Southwest Border states. However, CBP did not invest in an accounting and financial reporting 
infrastructure in proportion to its growth in mission. The accounting system, processes, and staffing level 
that exists is absorbing an increased workload, creating an environment where financial statement errors 
are more likely to occur, especially in areas that are new to CBP, such as construction of the virtual and 
physical fence along the Southwest Border. 



Condition: 

We noted that CBP: 

• Did not detect misstatements in its September 30, 2009 financial statements. Specifically, CBP 
misstated gross cost and earned revenue by $1.3 billion in its Statement of Net Cost. In addition, in 
Note 19, Intragovernmental Costs and Exchange Revenue, CBP incorrectly reported $2.9 billion of 
costs with the public as intragovernmental costs and $46.2 million of intragovernmental earned revenue 
as earned revenue with the public. Furthermore, Note 22, Apportionment Categories of Obligations 
Incurred, was misstated by $142 million. These errors were subsequently corrected prior to publishing 
the financial statements; 

• Did not add sufficient resources or infrastructure within the Office of Administration or in the operating 
divisions to supplement its current accounting and financial reporting personnel, and consequently has 
been unable to adequately monitor inputs and operational activities to ensure proper and timely 
accounting and reporting consideration; 

• Did not timely develop and effectively communicate policies and procedures to properly account for 
and report significant new activities that occur outside of the Office of Administration; 

• Did not have an annual risk assessment and/or focus group process that maintained its effectiveness to 
timely identify and address new accounting standards, and/or the application of existing standards to 
new operations, that may have a material impact on financial reporting on an ongoing basis throughout 
the year; 

• Did not timely address the impact of Statement of Federal Financial Accounting Standards (SFFAS) 
No. 29, Heritage Assets and Stewardship Land (SFFAS No. 29), fully effective for reporting periods 
beginning after September 30, 2008, and OMB Circular No. A- 136, Financial Reporting Requirements, 
on its financial statements. Although CBP hired a historian to manage its historical items, the Office of 
Administration did not have the resources to dedicate to this area, and therefore did not coordinate 
obtaining timely, relevant information for financial reporting. CBP did not fully analyze SFFAS No. 
29 until the external auditor requested an evaluation of the impact of SFFAS No. 29; and 

• Did not prepare a comparative FY 2008 Statement of Net Cost and related notes. DHS changed 
reporting goals during FY 2008 to align them with its Strategic Plan. In order to be consistent with 
DHS reporting, CBP changed the presentation of its FY 2009 financial statements to report more detail. 
However, CBP did not initially consider the presentation of comparative FY 2008 information for the 
newly presented programs. CBP later determined that it is unable to prepare comparative FY 2008 
financial statements due to limitations in its cost accounting system. 
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Criteria: 

OMB Circular No. A- 123, Management's Responsibility for Internal Control, defines internal control and 
provides guidance to Federal managers on improving the accountability and effectiveness of Federal 
programs and operations by establishing, assessing, correcting, and reporting on internal control. In 
particular, management is responsible for establishing and maintaining internal control to achieve the 
objectives of effective and efficient operations, reliable financial reporting, and compliance with applicable 
laws and regulations. The documentation for internal control, all transactions, and other significant events 
should be readily available for examination. Further, relevant, reliable, and timely information should be 
communicated to relevant personnel at all levels within an organization. It is also crucial that an agency 
communicate with outside organizations. In addition, the Circular states that management should identify 
both internal and external risks, and analyze those risks for their potential effect on the entity. 

SFFAS No. 29 states, "Entities with heritage assets should reference a note on the balance sheet that 
discloses information about heritage assets, but no asset dollar amount should be shown," and specifies the 
disclosure requirements related to Stewardship Property, Plant, and Equipment (PP&E). 

Statement of Federal Financial Accounting Concepts No. 1, Objectives of Federal Financial Reporting, 
states that financial reporting "should help report users make relevant comparisons among similar federal 
reporting units, such as comparisons of the costs of specific functions or activities. Comparability implies 
that differences among financial reports should be caused by substantive differences in the underlying 
transactions or organizations rather than by the mere selection of different alternatives in accounting 
procedures or practices." 

OMB Circular No. A- 136, Financial Reporting Requirements, addresses which elements of an agency's 
Annual Financial Statements must be presented on a comparative basis: "The basic statement identified 
above [which includes the Statement of Net Cost], and the related notes, should present balances and 
amounts for the current year and the prior year... The MD&A should include comparisons of the current 
year to the prior year and should provide an analysis of the agency's overall financial position and results 
of operations to assist users in assessing whether that financial position has improved or deteriorated as a 
result of the year's activities." 

Cause/Effect: 

CBP did not perform an adequate review to detect material misstatements in its financial statements. CBP 
did not make sufficient investments in its accounting and financial reporting infrastructure, including 
human resources, and did not identify and establish policies and procedures to account for substantial new 
operations. In addition, CBP does not have a formalized, continuous, and comprehensive communication 
process to timely identify and address changes to accounting standards that are important to financial 
reporting. Consequently, CBP and the external auditor have identified several errors in the financial 
statements that occurred throughout the year, some of which related to the prior year. 

Recommendations: 

We recommend that CBP: 

1. Update and reinforce its policies and procedures for assembling the financial statements to include 
standard reviews, approvals, and edit checks; 
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2. Conduct a human resource and finance organizational assessment to identify accounting and finance 
infrastructure improvements that should be made to ensure that the Office of Administration and 
operational units have the resources to establish necessary policies, procedures and controls in 
operational units, and to ensure effective monitoring of transactions and events to ensure accurate 
financial reporting; 

3. Develop and timely communicate policies and procedures to ensure that key financial reporting issues 
are addressed before, or at the same time, that significant new operations are undertaken. Such policies 
and procedures should ensure that CBP identify both changes in operations and changes in accounting 
standards; and 

4. Enhance the annual risk assessment and/or focus group process to ensure continued effectiveness and 
relevance in identifying new accounting standards, and/or the application of existing standards to new 
operations timely. 

B. Property, Plant, and Equipment (PP&E) 

1. Secure Border Initiative 

Background: 

CBP has acquired substantial new technology, facilities, and other assets in recent years 
through purchase and construction. Since FY 2004, CBP's capital assets have increased from 
$1.5 billion to $5.2 billion as of September 30, 2009, an increase of approximately 3.5 times in 
size. One of the largest components of this growth is the Secure Border Initiative (SBI), which 
is a comprehensive multi-year plan to secure America's borders and reduce illegal migration. 
SBI includes two main components: the Facilities Management and Engineering (FM&E) 
Tactical Infrastructure (TI) and the SBI Network (SBInet). To properly account for this level 
and complexity of capital expenditure, CBP has had to implement new accounting policies, 
procedures, and processes, and apply technical accounting standards not previously used by 
CBP, such as full-costing of construction projects. We noted several findings related to new 
operations, specifically related to PP&E, which demonstrate that financial management has not 
kept pace with this significant growth. 

Condition: 

We noted that CBP: 

• Did not timely address the accounting impact and the procedures necessary to capture all 
capitalized costs associated with the SBInet. These procedures included communicating 
with and providing training to program office personnel about necessary accounting 
information, determining a base unit of a depreciable asset, determining a methodology for 
recording the construction in progress (CIP) percentage of completion, and determining a 
methodology for recording overhead costs. CBP did not investigate a majority of these 
issues until FY 2009, nearly a year after the project began. As a result of this untimely 
communication, CBP expensed approximately $163 million in FY 2008 and an additional 
$30 million in FY 2009 that should have been capitalized as CIP as of September 30, 2008; 

• Did not have a fully integrated system to account for assets acquired related to the SBInet 
program. In addition, neither CBP nor its contractor are tracking all accountable property 
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because several assets were tracked together as a group rather than individual assets and 
other assets were recorded in various sub-contractors' systems, but not CBP's systems; 

• Over-depreciated assets related to the FM&E TI physical fence by approximately $30 
million because CBP did not timely adjust the useful life for the steel fence and instead 
applied the same six-year useful life that had been applied to previous wire fences. Upon 
analysis, CBP determined that this useful life should be twenty years. This analysis was 
completed prior to the issuance of the FY 2008 financial statements; however, the offices 
that coordinated the analysis did not timely communicate the analysis to the Office of 
Administration to adjust the financial statements; and 

• Did not thoroughly review the accuracy of amounts reported by project managers for the 
FM&E TI CIP percentage of completion (POC) accrual in some instances, and therefore 
had an estimated net understatement of CIP of $18 million. Furthermore, CBP did not 
detect calculation errors in the CIP POC at both March 3 1 and June 30, 2009. 

Criteria: 

OMB Circular No. A- 123 defines internal control and provides guidance to Federal managers 
on improving the accountability and effectiveness of Federal programs and operations by 
establishing, assessing, correcting, and reporting on internal control. In particular, management 
is responsible for establishing and maintaining internal control to achieve the objectives of 
effective and efficient operations, reliable financial reporting, and compliance with applicable 
laws and regulations. The documentation for internal control, all transactions, and other 
significant events should be readily available for examination. Further, relevant, reliable, and 
timely information should be communicated to relevant personnel at all levels within an 
organization. It is also crucial that an agency communicate with outside organizations. In 
addition, the Circular states that management should identify both internal and external risks, 
and analyze those risks for their potential effect on the entity. 

SFFAS No. 6, Accounting for Property, Plant, and Equipment, states that: 

- PP&E consists of tangible assets, including land, that meet the following criteria: they 
have estimated useful lives of 2 years or more; they are not intended for sale in the 
ordinary course of operations; and they have been acquired or constructed with the 
intention of being used, or being available for use by the entity; 

- All PP&E shall be recorded at cost. Cost shall include all costs incurred to bring the 
asset to a form and location suitable for its intended use; and 

Depreciation expense is calculated through the systematic and rational allocation of the 
cost of general PP&E, less its estimated salvage/residual value, over the estimated useful 
life of the general PP&E. 

Cause/Effect: 

CBP's substantial growth, especially in the purchase and construction of capital assets, has 
required greater capacity of human and system resources, including resources outside of the 
Office of Administration. As a result, accounting for new operations, such as the 
construction of FM&E TI and SBInet, are not considered in a timely manner, causing errors 
or misapplication of U.S. generally accepted accounting principles (GAAP) in financial 
reporting. These financial statement errors and/or inconsistencies with GAAP may go 
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undetected, in some cases until subsequent years or until questioned by an auditor. 
Furthermore, CBP did not establish a thorough plan before beginning the SBInet project to 
account for the assets and costs necessary to implement these projects. For instance, CBP 
did not prepare detailed instructions regarding the level it would track each asset acquired 
and how those assets related to the capitalized units recorded in the financial statements. 
Therefore, CBP is unable to track the location of each asset as it is replaced, repaired, or 
moved due to its lack of a fully integrated property system. This may reduce CBP's ability 
to accurately account for capital improvements as compared to repair and maintenance 
expenses. This deficiency is also related to the conditions described in Section A, Financial 
Reporting. 

Recommendations: 

We recommend that CBP: 

1. Conduct an assessment of the resources in the Office of Administration dedicated to 
PP&E to determine whether the accounting function has appropriate structure and 
personnel in these areas to match the breadth and depth of its rapidly growing operations 
and make changes, as appropriate; 

2. Develop policies and procedures to ensure that key financial reporting issues are 
addressed in a timely manner. Such policies and procedures should ensure that CBP 
identify both changes in operations and changes in accounting standards. This 
recommendation is also related to Section A, Financial Reporting; 

3. Conduct a critical assessment of agency -wide communication and make immediate 
changes to ensure that significant financial-related events outside of the Office of 
Administration are timely communicated to the Office of Administration for proper and 
timely accounting and reporting consideration; and 

4. Develop policies and procedures to track all SBInet assets within its financial system of 
record in order to integrate the tracking of CBP's SBInet property with its core financial 
system. 

2. Improper Settlement of Assets from Construction in Progress 
Condition: 

During FY 2009, we noted weaknesses related to the untimely capitalization of completed CIP 
assets to completed fixed assets. Specifically, we noted 61 instances in which assets were 
moved untimely from CIP to fixed assets. In addition, we noted eight instances in which CBP 
did not properly complete its formalized process for the settlement of assets placed into service 
and three instances in which the amount allocated to the final asset from CIP did not agree to 
the supporting documentation. As of September 30, 2009, CBP recorded an additional $22 
million in accumulated depreciation and depreciation expense to correct for the identified 
errors. 
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Criteria: 

SFFAS No. 6 requires that "PP&E shall be recognized when title passes to the acquiring entity 
or when the PP&E is delivered to the entity or to an agent of the entity. In the case of 
constructed PP&E, the PP&E shall be recorded as construction work in process until it is 
placed in service, at which time the balance shall be transferred to general PP&E." In addition, 
it states that "All general PP&E shall be recorded at cost. Cost shall include all costs incurred 
to bring the PP&E to a form and location suitable for its intended use." 

OMB Circular No. A- 123 states, "Management is responsible for developing and maintaining 
effective internal control. Effective internal control provides assurance that significant 
weaknesses in the design or operation of internal control, that could adversely affect the 
agency's ability to meet its objectives, would be prevented or detected in a timely manner." In 
addition, "management should identify internal and external risks that may prevent the 
organization from meeting its objectives. When identifying risks, management should take into 
account relevant interactions within the organization as well as with outside organizations." 

Cause/Effect: 

CBP did not process and record the transfer of completed assets from CIP to in-use assets (i.e., 
settlement of assets) in a timely manner and does not have a formal, robust process to 
periodically review assets recorded as CIP and determine if they have been placed in service. 
As a result, CIP, PP&E, depreciation expense, and accumulated depreciation may be misstated 
at any point during the fiscal year. 

Recommendation: 

We recommend that CBP: 

1 . Establish and implement a standardized process that is integrated with its financial system 
of record in order to facilitate the timely recording of assets placed into service; and 

2. Develop policies and procedures to require that program offices and/or project managers 
periodically review their listing of assets recorded as CIP and determine if any of these 
assets have been placed in service. 

3. Management Oversight of PP&E and Transactions 

Condition: 

We noted that CBP: 

• Did not properly perform and/or document several physical annual inventories related to 
real and personal property; 

• Recorded certain asset additions in duplicate, for an amount other than the amount 
invoiced, or using the incorrect general ledger account; 



Did not consistently follow its procedures for recording asset retirement transactions 
because CBP did not record certain transactions timely; disposed of assets prior to the 
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completion of the appropriate disposal authorization form; and recorded transactions 
without supporting documentation; 

• Did not properly account for it operating materials and supplies as of March 31, 2009. 
Specifically, materials held for repair were recorded twice and certain equipment was 
improperly classified as operating materials and supplies. In addition, CBP records 
operating materials and supplies at replacement cost, rather than historical cost; and 

• Did not consistently record PP&E transactions based on its classification and/or transaction 
code structure. 

Criteria: 

SFFAS No. 6 states that: 

PP&E consists of tangible assets, including land, that meet the following criteria: they 
have estimated useful lives of 2 years or more; they are not intended for sale in the 
ordinary course of operations; and they have been acquired or constructed with the 
intention of being used, or being available for use by the entity; 

PP&E shall be recognized when title passes to the acquiring entity or when the PP&E is 
delivered to the entity or to an agent of the entity. In the case of constructed PP&E, the 
PP&E shall be recorded as construction work in process until it is placed in service, at 
which time the balance shall be transferred to general PP&E; 

- All PP&E shall be recorded at cost. Cost shall include all costs incurred to bring the 
asset to a form and location suitable for its intended use; 

- In the period of disposal, retirement, or removal from service, general PP&E shall be 
removed from the asset accounts along with associated accumulated 
depreciation/amortization. Any difference between the book value of the PP&E and 
amounts realized shall be recognized as a gain or a loss in the period that the general 
PP&E is disposed of, retired, or removed from service; and 

- Depreciation expense is calculated through the systematic and rational allocation of the 
cost of general PP&E, less its estimated salvage/residual value, over the estimated useful 
life of the general PP&E. 

SFFAS No. 3, Accounting for Inventory and Related Property, states "Valuation Under the 
Consumption Method. Operating materials and supplies shall be valued on the basis of 
historical cost." 

OMB Circular No. A- 123 states that "Management is responsible for developing and 
maintaining effective internal control. Effective internal control provides assurance that 
significant weaknesses in the design or operation of internal control, that could adversely affect 
the agency's ability to meet its objectives, would be prevented or detected in a timely manner." 

Cause/Effect: 

CBP's guidance for performing and documenting PP&E inventories was neither clearly stated 
nor consistently followed. CBP does not have sufficient policies and procedures or did not 
enforce policies and procedures related to the review of PP&E transactions for accuracy, 
classification, and timeliness. CBP did not perform a proper review of purchase requisitions to 



EXHIBIT I 



determine whether the costs incurred should be capitalized or expensed. As a result, CBP's 
PP&E balance may be misstated by the recording of transactions, which are incorrect, 
unsupported, or untimely. 

Recommendation: 

We recommend that CBP: 

1. Refine and reinforce guidance for the performance and documentation of PP&E 
inventories; 

2. Develop, document, and communicate policies and procedures for classifying, recording, 
and reviewing all PP&E transactions. These procedures should include agreeing the 
transaction to supporting documentation, ensuring that the transactions are recorded timely, 
and reviewing the transaction type and general ledger accounts in which the transactions 
are recorded to ensure that the financial statements are materially correct and presented in 
accordance with GAAP; 

3. Emphasize the need to record asset disposals in accordance with established policy; 

4. Provide sufficient accounting training to all relevant personnel who process PP&E 
transactions; and 

5. Develop, document, and communicate policies and procedures for the proper establishment 
and review of purchase requisitions as either capital assets or expenses. 

C. Drawback of Duties, Taxes and Fees 
Background: 

U.S. Customs and Border Protection (CBP), as a component of the U.S. Department of Homeland Security 
(Department or DHS), continued to perform an important revenue collection function for the U.S. 
Treasury. CBP collected approximately $26.4 billion in import duties, taxes and fees in fiscal year 2009 on 
merchandise arriving in the United States from foreign countries. 

Drawback is a remittance, in whole or in part, of duties, taxes, or fees previously paid by an importer. 
Drawback typically occurs when the imported goods on which duties, taxes, or fees have been previously 
paid are subsequently exported from the United States or destroyed prior to entering the commerce of the 
United States. Depending on the type of drawback claim, the claimant has up to eight years from the date 
of importation to file for drawback. The Miscellaneous Trade and Technical Corrections Act of 2004 
(Public Law 108-429) created a limited timeframe for liquidating claims; the new process is known as 
deemed-liquidation by CBP. In response to the new timeframe for liquidation of drawback claims, CBP 
implemented policies and procedures that require the payment of claims in an accelerated timeframe. 

Condition: 

We noted the following weaknesses related to internal controls over drawback of duties, taxes, and fees 
paid by the importer: 
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• The Automated Commercial System (ACS) lacked automated controls to detect and prevent excessive 
drawback claims and payments, necessitating inefficient manual processes that do not effectively 
compensate for the lack of automated controls. ACS did not have the capability to compare, verify, and 
track essential information on drawback claims to the related underlying consumption entries or export 
documentation upon which the drawback claim was based. For example, ACS did not contain 
electronic edit checks that would identify duplicate claims for export of the same merchandise; 

• ACS lacked controls to prevent the overpayment of drawback claims at the summary line level; 

• Drawback review policies did not require drawback specialists to review all or a statistically valid 
sample of prior drawback claims against the underlying consumption entries (UCE) to determine 
whether, in the aggregate, an excessive amount was claimed. CBP does not have absolute assurance 
that a selected import entry is not being over claimed by different drawback claims; 

• Drawback review policy and procedures allow drawback specialists, with supervisory approval, to 
judgmentally decrease the number of ACS selected UCEs randomly selected for review, thus 
decreasing the review's effectiveness. Further, CBP's sampling methodology for selecting UCEs is not 
considered to be statistically valid; and 

• The period for document retention related to a drawback claim is only three years from the date of 
payment. However, there are several situations that could extend the life of the drawback claim well 
beyond three years. 

Cause/Effect: 

Much of the drawback process is manual, placing an added burden on limited resources. CBP uses a 
sampling approach to compare, verify, and match consumption entry and export documentation to 
drawback claims submitted by importers. However, system and procedural limitations decrease the 
effectiveness of this approach. The inherent risk of fraudulent claims or claims made in error is high, which 
increase the risk of erroneous payments. 

Criteria: 

Under the Federal Managers Financial Integrity Act of 1982 (FMFIA), management must implement cost- 
effective controls to safeguard assets and ensure reliable financial reporting. Office of Management and 
Budget (OMB) 's Revised Implementation Guidance for the Federal Financial Management Improvement 
Act states that financial systems should "routinely provide reliable financial information uniformly across 
the Federal government following professionally-accepted accounting standards" to support management 
of current operations. The Federal Systems Integration Office (FSIO) publications and OMB Circular No. 
A- 127, Financial Management Systems, outline the requirements for Federal systems. FSIO's Core 
Financial System Requirements states that the core financial system must maintain detailed information by 
account sufficient to provide audit trails and to support billing and research activities. OMB Circular No. 
A- 127 requires that the design of financial systems should eliminate unnecessary duplication of a 
transaction entry. Whenever appropriate, data needed by the systems to support financial functions should 
be entered only once and other parts of the system should be updated through electronic means consistent 
with the timing requirements of normal business/transaction cycles. 

The Office of Management and Budget (OMB) Circular No. A-123, Management's Responsibility for 
Internal Control, states that "management is responsible for establishing and maintaining internal controls 
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to achieve the objectives of effective and efficient operations, reliable financial reporting, and compliance 
with applicable laws and regulations." 

Recommendations: 

We recommend that CBP: 

1. Implement effective internal controls over drawback claims as part of any new system initiatives, 
including the ability to compare, verify, and track essential information on drawback claims to the 
related underlying consumption entries and export documentation for which the drawback claim is 
based, and identify duplicate or excessive drawback claims; 

2. Implement automated controls to prevent overpayment of a drawback claim; and 

3. Develop a system or process to eliminate the need for statistical sampling of UCE and prior related 
drawback claims. In addition, until this system or process is implemented, we recommend that CBP 
explore other statistical approaches for selecting UCEs and prior related drawback claims under the 
current ACS environment. 

CBP Response: 

See management's response included in the attached letter. 
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Other Significant Deficiencies 
D. Inactive Obligations 
Background: 

CBP issued Directive 1220-01 IB, Quarterly Review of Unliquidated Obligations, during fiscal year 
2006, which requires each Office under CBP to review their obligations quarterly in order to properly 
identify those amounts that require deob ligation. The review must be reported to CBP's National Finance 
Center (NFC) each quarter. On June 11, 2009, CBP Directive 1220-01 IB was superseded by CBP 
Directive 1220-01 1C, Reviews of Unliquidated Obligations and Open Goods/Service Receiving 
Records, which requires all obligation and open goods receipt and service entry sheet records to be 
reconciled to supporting documentation at the close of each quarter of the fiscal year, i.e., December 31, 
March 31, June 30, and September 30. Additionally, a semi-annual review of specific populations of 
obligations must be performed and the status for each record identified. 

Condition: 

CBP is not enforcing its policies and procedures to monitor and deobligate or close-out its obligations in a 
timely manner. We conducted a review of inactive obligations at June 30, 2009 and identified $51.7 
million that potentially required deobligation. CBP initiated a review of open obligations that was 
completed in fourth quarter fiscal year 2009 from which invalid obligations were identified for 
deobligation. CBP was unable to process all deobligations at the detail level prior to September 30, 2009, 
and therefore, recorded an on-top adjustment for inactive obligations in the amount of $114 million. 
Through additional testing of undelivered orders (UDOs) as of September 30, 2009, we noted 23 invalid 
UDO balances. 

Furthermore, CBP is not properly enforcing its policies and procedures for timely receipt of certification 
letters and deobligation of expired contracts. We noted as of December 31, 2008, 16 offices that 
submitted certification letters to certify the review of all open obligations to the Director of the National 
Finance Center, 10 of these submissions were later than 30 days after the end of the quarter. During our 
procedures performed over contracts as of March 3 1 , 2009, we noted that CBP did not close three expired 
contracts in the financial system because funds were not deobligated. 

Criteria: 

U.S. Code Title 31 Section 1501 states that "an amount shall be recorded as an obligation of the United 
States Government only when supported by documentary evidence of (1) a binding agreement between an 
agency and another person (including an agency) that is (a) in writing, in a way and form and for a 
purpose authorized by law; and (b) executed before the end of the period of availability..." Section 1554, 
Audit, control and reporting states, "The head of each agency shall establish internal controls to assure 
that an adequate review of obligated balances is performed to support the certification required by section 
1108(c) of this title." 

CBP Directive 1220-01 1C states that "All obligation and open goods receipt and service entry sheet 
records must be reconciled to supporting documentation at the close of each quarter of the fiscal year, i.e., 
December 31, March 31, June 30, and September 30. Additionally, a semi-annual review of specific 
population of obligations must be performed and the status for each record identified. This is done to 
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reasonably assure that only valid obligations remain open and open goods receipt and service entry sheet 
records are accurate." 

CBP Directive 1220-01 IB states that "Financial Plan Holder will review the following Systems, 
Applications, and Products (SAP) reports each fiscal quarter to reconcile their obligations to supporting 
records." This directive also requires that "Each Assistant Commissioner will prepare a certification 
letter to the Director, National Finance Center, stating that he/she has reviewed all open obligations. The 
certification letter will be prepared at the end of each fiscal year quarterly review, and is due no later than 
30 days after the end of the quarter. For the fourth quarter, year-end deadlines are to be followed." 

Cause/Effect: 

CBP is not properly enforcing its policies and procedures to monitor all open obligations on a periodic 
basis to determine if amounts require deobligation. As a result, undelivered orders and related account 
balances may be overstated at any point during the fiscal year. 

Recommendations: 

We recommend that CBP: 

1. Re-emphasize and reinforce compliance with Directive Nos. 1220-01 IB and 1220-01 1C to ensure 
that obligations are being reconciled to supporting documentation on a quarterly basis (and 
deobligated, if necessary) and reviewed for validity on a semi-annual basis. In addition, monitor the 
timely receipt of quarterly certification letters and semi-annual reports; 

2. Re-emphasize and reinforce compliance with 31 USC 1501 and 31 USC 1554 and all other 
applicable laws and regulations; and 

3. Develop and implement procedures in order to deobligate invalid obligations in a timely manner, 
which may include periodic validation of inactive obligations. 

E. Entry Process 

1. In-Bond Program 

Background: 

General In-Bond Process 

An in-bond entry occurs when an importer brings an item through one port; however, the item 
generally does not officially enter U.S. commerce until it reaches the intended port of 
destination. An in-bond also allows foreign merchandise arriving at one U.S. port to be 
transported through the U.S. and be exported from another U.S. port without the payment of 
duty. 

Compliance Audit and In-Bond 

In 1998, CBP implemented an audit system within the Automated Commercial System (ACS). It 
serves as a compliance measurement system, which utilizes random examinations and port audit 
reviews to ensure compliance. This audit system was designed to ensure bonded carrier 
compliance with their bond obligations. The audit system uses TINMAN to select ports to 
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perform physical examinations at the time of arrival and departure and to perform post audit 
reviews of carrier activity. Once each week, ports throughout the U.S. are assigned post audits 
and physical examinations to perform based on a GAO-approved algorithm. 

In-Bond Shipments Overdue for Export (M02) Report 

The M02 report is a monthly list of in-bond shipments overdue for export. Items on this report 
are in-bond movements transmitted by importers or brokers via Automated Manifest System 
(AMS), Automated Broker Interface (ABI), or paper not yet exported in the required time 
limit. Review of the M02 report is designed to identify cargo that has not been exported and 
therefore may have physically, but not formally entered into U.S. commerce, thus 
circumventing the assessment and payment of duties and fees. 

Monthly List of In-Bond Shipments Overdue (M07) Report 

On a bi-monthly basis, each port is required to review and reconcile a list of In-Bond 
Shipments Overdue included in the M07 report. Data on paperless and conventional in-bond 
movements transmitted by AMS participants, as well as in-bond information input via INBE 
appears in this report. In-bonds are considered overdue if they have not arrived at the 
destination port within 30 days from departure. Review of the M07 report is designed to 
identify cargo that has not been entered into the U.S. at the original port of entry 
communicated to CBP, thus possibly entering the U.S. commerce and circumventing the 
assessment and payment of duties and fees. 

Condition: 

We noted the following weaknesses exist over the in-bond program: 

• Ports are required to submit a summary of post audits conducted and the associated 
results to HQ; however, due to ACS system limitations, HQ cannot prepare an oversight 
report to determine if ports have completed all required audits. The SINS function code 
generates a report that is designed to provide this information, but it currently does not 
accurately list the history of all in-bonds selected for audit and is not consistent with the 
listing of incomplete TINMAN audits on the INES report. 

• The M02 report does not track air in-bonds. CBP is currently creating the Ml 9 report to 
track air in-bonds, but the Ml 9 report was not available in fiscal year 2009. 

• The requirement for ports to review the M07 report (pertaining to Immediate Transport 
in-bonds) was not issued until February 2009, and was therefore not in operation for all 
of the fiscal year. 

• There is no formal requirement for ports to maintain documentation evidencing the 
performance of and results from post-audits and physical examinations. 

• There is no formal requirement for ports to document the resolution of items on the M02 
and M07 reports. Documentation evidences that the resolution was appropriate and 
allows for proper oversight of the completion of these reports. 

• CBP does not perform a formal analysis to ensure there is not a potentially significant 
loss of revenue through the in-bond process, as a result of goods entering the commerce 
of the U.S. without formal entry. 

• CBP did not consistently monitor and document its review of the M02 and M07 reports 
and query ACS and document completion of TINMAN audits on a timely basis. 



EXHIBIT II 



Criteria: 

According to Title 19 Section 18.2(d) of the Code of Federal Regulations (CFR), the carrier's 
"failure to surrender the in-bond manifest or report the arrival of bonded merchandise within 
the prescribed period shall constitute an irregular delivery and the initial bonded carrier shall 
be subject to applicable penalties." 

The Office of Management and Budget (OMB) Circular No. A-123, Management's 
Responsibility for Internal Control, states that "management is responsible for establishing 
and maintaining internal controls to achieve the objectives of effective and efficient 
operations, reliable financial reporting, and compliance with applicable laws and regulations." 

Cause/Effect: 

In recent years, the in-bond program has implemented several new directives and a new 
handbook to address the performance of the program at the port level; however, there is not a 
documentation requirement at the national level related to the M02 and M07 reports. 
Additionally, ports are not completely or properly monitoring the post audit in-bond process 
due to staffing levels at the port level and an increased focus on other CBP programs. Current 
ACS system limitations also limit the ability of CBP to accurately monitor the in-bond 
process, both at the headquarters and port levels. 

The inability to effectively monitor the in-bond process and verify the arrival of in-bond 
merchandise at the port level leads to a potential loss in revenue. In addition, the lack of an 
automatic compilation and analysis of audit results at the national level makes it difficult for 
CBP to efficiently and fully determine the effectiveness of in-bond audits, common in-bond 
errors, and weaknesses in the overall in-bond process. 

Recommendations: 

We recommend that CBP: 

1. Ensure that the following functionalities are included in CBP's information systems: 

• Consistent information to track the status of TINMAN audits; 

• A robust Ml 9 report to track air in-bonds; 

• Compilation of the results of all TINMAN audits performed during the year; 

• An analysis function to evaluate importers' compliance with regulations and overall 
effectiveness of the in-bond process; 

2. Increase HQ oversight of the in-bond process by: 

• Analyzing the summary of post-audits conducted and associated results; 

• Providing increased training to port personnel on the in-bond process, to include 
performing TINMAN audits and working monitoring reports; 

3. Ensure all ports perform TINMAN audits timely, as required; 

4. Develop or re-emphasize formal requirements for all ports to: 
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• Continue to run and work the M07 report throughout the year to track overdue 
Immediate Transportation in-bonds; 

• Run and work the Ml 9 report to track open air in-bonds, once implemented; 

• Maintain documentation evidencing the performance of and results from post-audits 
and physical examinations; 

• Maintain documentation related to the resolution of items on the M02, M07, and, 
once implemented, Ml 9 reports. Documentation of these items will allow for 
effective management oversight of the use of these tools; 

5. Annually analyze the in-bond program to ensure there is not a significant potential loss of 
revenue relating to in-bonds. 

2. Entry Summary Compliance Measurement 

Background: 

Entry Summary Compliance Measurement (ESCM) is the primary method by which CBP 
measures risk in the areas of cargo security, trade compliance, and revenue collection. CBP 
utilizes the ESCM to measure the effectiveness of its control mechanisms deployed and its 
execution in collecting revenues rightfully due the U.S. Department of the Treasury. The 
ESCM program is a key performance indicator used to determine if CBP's internal controls 
are operating effectively as they pertain to ensuring compliance with laws and regulations. 
The Compliance Measurement program is also used to determine the revenue gap that is 
reported in the "Other Accompanying Information" in the financial statements. 

Condition: 

We noted the following weaknesses related to ESCM: 

• A memorandum entitled "Compliance Measurement for FY 2009 - Change of Policy on 
120-Day ISDA Input Requirement" dated March 17, 2009, rescinded the requirement to 
input initial remarks into ACS using the "ISDA" function code within 60 days and final 
remarks within 120 days. Instead, the memo suggests a 120 day deadline but only 
requires a final input date of January 31, 2010, for final remarks for FY 2009 Import 
Specialists' review. This formal annual deadline does not provide for timely, effective, 
and continuous monitoring of ESCM. 

• In FY 2008, guidance from the Commercial Targeting and Enforcement Directorate 
suspended the requirement for ESCM Coordinators at the ports to perform random 
reviews of non-anomalous lines. This suspension was not replaced by any other data 
query or tool in FY 2009. 

• Through corroborative inquiry at the eleven statistically-selected ports of entry, we noted 
that the Compliance Measurements Accuracy Tracking Systems (CMATS) tool was not 
operational in the first six months of 2009 and had numerous delays in version releases in 
the 3 rd quarter of FY 2009. CBP did not have oversight of ESCM through use of any 
other tools when CMATS was not operational at two of the eleven ports tested. 
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• The CMATS tool operates off the Customs Automated Port Profile (CAPPS) database, 
which is a monthly cumulative compilation of all CBP examinations. However, since the 
CAPPS database is generally released the third week of each month, there is a time lag 
between the information in the CMATS report and the discrepant entries that have 
previously been resolved. 

• Up until FY 2006, the National Targeting and Control Branch (NTCB) performed port 
audits to identify errors during the performance of an ESCM review. Since FY 2006, 
CBP-HQ has relied on the Self-Inspection Program (SIP) to determine how the ports are 
performing ESCM examinations; however, the SIP worksheets do not provide the 
equivalent information that was provided by the twenty-five point audit report utilized in 
the NTCB port audits. Despite revisions to the ESCM SIP worksheets, SIP alone does 
not provide for a sufficient review of ESCM. 

• CBP has not fully implemented the Mission Action Plan (MAP) CBP-MAP-08-17 
because CBP is in the process of developing a statistically-valid random sample of 
ESCM reviews to be completed at the port level each month. In addition, CBP is in the 
process of developing tracking mechanisms to be updated by headquarters on a quarterly 
basis to ensure that ports are in compliance with ESCM guidelines and requirements. 
These elements described in CBP-MAP-08-17 were not fully implemented or revised to 
reflect changes in the planned actions as of September 2009. 

Criteria: 

Statement of Federal Financial Accounting Standards (SFFAS) No. 7, Accounting for 
Revenue and Other Financing Sources and Concepts for Reconciling Budgetary and 
Financial Accounting, Section 69.2 - Available information on the size of the tax gap, states, 
"Collecting entities should provide any relevant estimates of the annual tax gap that become 
available as a result of federal government surveys or studies. The tax gap is defined as taxes 
or duties due from non-compliant taxpayers or importers. Amounts reported should be 
specifically defined, e.g., whether the tax gap includes or excludes estimates of taxes due on 
illegally earned revenue." 

OMB Circular No. A- 136, Financial Reporting Requirements, Section II.5.3, Tax 
Burden/Tax Gap, states, "Preparers of statements of entities that collect taxes may consider 
presenting the information described below, if the information is readily available and the 
preparers believe the information will enhance the usefulness of the statements. Refer to 
SFFAS No. 7 for further guidance. 

A perspective on the income tax burden. This could take the form of a summary of the latest 
available information on the income tax and on related income, deductions, exemptions, and 
credits for individuals by income level and for corporations by value of assets. 

Available information on the size of the tax gap. Collecting entities should provide any 
relevant estimates of the annual tax gap that become available as a result of Federal surveys 
or studies." 

OMB Circular No. A-123 states that "management is responsible for establishing and 
maintaining internal controls to achieve the objectives of effective and efficient operations, 
reliable financial reporting, and compliance with applicable laws and regulations." 
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Cause/Effect: 

Policies and procedures have not been developed and/or implemented to ensure the reliability 
and accuracy of ESCM input results. The self-inspection worksheet to be completed by the 
ports does not require a sufficient level of review to be considered a mitigating control. The 
CMATS tool was not operating sufficiently to provide effective, consistent review of ESCM 
entries at the port level. 

Incomplete guidelines may result in an inappropriate review of ESCM entries. With 
inadequate oversight of the ESCM data, CBP may have an inaccurately projected revenue 
gap- 

Recommendations: 

We recommend that CBP implement the following to improve ESCM: 

1 . Require CM Coordinators at ports to perform reviews on a timely and continuous basis; 

2. Establish criteria, reporting, and tracking mechanisms at Headquarters for reviewing all 
ESCM entries. Headquarters should use these tracking mechanisms to perform additional 
oversight over the ESCM process, at least on a quarterly basis; 

3. Modify the CMATS tool to exclude errors and anomalies relating to untimely input of 
ISDA remarks, and instead require CM Coordinators to run a single, standardized data 
query at least on a monthly basis of open ISDA remarks to ensure efficient and accurate 
ESCM reviews; and 

4. Develop and utilize analysis tools to measure outstanding and completed ESCM reviews 
and utilize the analysis tool at the port level to ensure that Import Specialists complete 
ESCM reviews in a timely yet achievable manner. This can be achieved by re-instating 
the 120-day requirement with provisions for an appropriate allowance for acceptable 
deviations from the requirement. The allowance can be in the form of a benchmark based 
on past data. 

3. Bonded Warehouse and Foreign Trade Zones 
Background: 

Bonded Warehouses (BWs) are facilities under CBP's supervision used to store merchandise 
that has not made entry into the U.S. Commerce. BWs are used to provide a place for storing 
goods in the U.S. for up to 5 years. The goods that are stored in such warehouses are secured 
by the bond on the warehouse. Goods are entered into the BW by submission of the CBP 
Entry Summary Form 7501. 

Foreign Trade Zones (FTZs) are secure areas under CBP supervision considered outside of 
the CBP territory. Authority for establishing these facilities is granted by the Foreign Trade 
Zones Board under the Foreign Trade Zones Act of 1934, as amended (19 U.S.C. 81a-81u). 
Foreign and domestic merchandise may be moved into zones for operations not otherwise 
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prohibited by law, including storage, exhibition, assembly, manufacturing, and processing. 
Goods are admitted into an FTZ using CBP Form 214. 

Condition: 

We noted the following internal control weaknesses related to the BW and FTZ processes: 

• While CBP has developed national databases within the Automated Commercial 
Environment (ACE), which contain an inventory of all BWs and FTZs, such databases 
have not been tested for completeness. In addition, these databases are not currently used 
to document the assessed risk of each BW or FTZ, compliance reviews scheduled, or the 
results of compliance reviews. Furthermore, there are no requirements for HQ or the 
Field Offices to compare this database to the compliance review schedules submitted by 
the ports to ensure that all compliance reviews are being performed. 

• The BW and FTZ Compliance Review Manuals did not have specific guidance, in the 
form of a questionnaire or checklist, for determining the risk assessment of a BW or FTZ. 
The Compliance Review Manuals stated that a risk assessment should be performed by 
"analyzing and combining the findings of compliance reviews, security surveys, 
compliance measurement data, informed and enforced compliance, historical data, and 
other risk factors listed in this handbook." However, there is no standard guidance on 
how a port should specifically evaluate this data for each BW or FTZ; the relative 
importance/priority of each data source; and how a port should analyze these sources and 
any deficiencies noted to determine the assessed risk, in order to help ensure consistency 
in how ports evaluate risk. 

• In FY 2009, HQ implemented an electronic survey that it completes at the end of the 
fiscal year to determine the status of the BW and FTZ programs; however, the survey did 
not conclude on the effectiveness of compliance reviews. In addition, the survey did not 
contain detailed descriptions of common discrepancies identified in those compliance 
reviews, risks presented by those discrepancies, or techniques for mitigating those risks. 

• As part of our testwork at ten ports with BW and FTZ facilities, we noted the following 
specific findings related to BW and FTZ internal controls: 

o The risk assessment for one FTZ at one port was not performed; 

o The risk assessment for one BW at one port was marked as low risk; however, the 

errors noted in the compliance review documentation more accurately reflect a 

medium risk. 

Criteria: 

Under the Code of Federal Regulations, CBP's supervisory authority over bonded 
warehouses and foreign trade zones is outlined in Title 19, Section 19.4(a), "...the port 
director may authorize a Customs officer to supervise any transaction or procedure at the 
bonded warehouse facility. Such supervision may be performed through periodic audits of 
the warehouse proprietor's records, quantity counts of goods in warehouse inventories, spot 
checks of selected warehouse transactions or procedures or reviews of conditions of 
recordkeeping, storage, security, or safety in a warehouse facility." Title 19, Section 146.3 
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states, (a), "Customs officers will be assigned or detailed to a zone as necessary to maintain 
appropriate Customs supervision of merchandise and records pertaining thereto in the zone, 
and to protect the revenue." (b), "Supervision may be performed through a periodic audit of 
the operator's records, quantity count of goods in a zone inventory, spot check of selected 
transactions or procedures, or review of recordkeeping, security, or conditions of storage in a 
zone." 

OMB Circular No. A-123 states that "management is responsible for establishing and 
maintaining internal controls to achieve the objectives of effective and efficient operations, 
reliable financial reporting, and compliance with applicable laws and regulations." 

Cause/Effect: 

CBP does not have comprehensive guidance related to the determination and documentation 
of risk assessments. CBP does not have formal, comprehensive guidance related to the 
monitoring of the BW and FTZ programs by HQ and the Field Offices throughout the year. 
At the time of testwork, CBP did not have a comprehensive information system to document 
risk assessments, track both scheduled and completed compliance reviews, and perform HQ 
and Field Office monitoring and analysis of the BW and FTZ programs. 

CBP cannot effectively monitor the BW/FTZ program if a complete population of all BWs 
and FTZs is not compiled. The lack of specific guidance for determining risk assessment 
leads to inconsistent procedures in assessing risk at the port level. 

Recommendations: 

We recommend that CBP: 

1. Continue to develop standardized procedures for HQ or field office oversight to ensure 
compliance review schedules are being reviewed, and that all ports are aware of updates 
and changes to the program and can consistently execute all requirements presented in the 
compliance review manuals and handbooks; 

2. Continue the current implementation of national databases of all BWs and FTZs within 
ACE and SharePoint and develop procedures to ensure their completeness. Develop 
functionality for these databases to document risk assessments, compliance reviews, and 
their results; 

3. Continue to develop and implement standard procedures for conducting risk assessments 
for all BWs and FTZs. The standard procedures should include a questionnaire or 
checklist, which lists the areas of risk to evaluate, the relative importance of each area, 
and examples of possible high risk indicators; 

4. Create a standard format for compliance review schedules to be utilized by all ports for 
transmission to CBP-HQ; 

5. Utilize and enhance its electronic port survey system to provide more detailed and timely 
information on the BWH and FTZ programs to enable meaningful analysis by HQ; 
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6. Using the information received from the more detailed port survey system or through 
other means, prepare an analysis of common discrepancies identified in compliance 
reviews, risks presented by those discrepancies, and techniques for mitigating those risks; 

7. Increase HQ and field office oversight to ensure that compliance reviews are being 
conducted properly and timely in accordance with the Compliance Review Handbooks; 
and 

8. Continue to offer and enhance annual training to CBP BW/FTZ personnel to provide 
updates and changes to the program, and reinforce requirements over the program. 

F. Information Technology 
Background: 

Controls over information technology (IT) and related financial systems are essential elements of 
financial reporting integrity. Effective general controls in an IT and financial systems environment are 
typically defined in five key control areas: security management, access control, configuration 
management, segregation of duties and contingency planning. In addition to reliable controls, financial 
management system functionality is important to program monitoring, increasing accountability of 
financial and program managers, providing better information for decision-making, and increasing the 
efficiency and effectiveness of services provided by the Federal government. 

Condition: 

During FY 2009, CBP took corrective actions to address prior year IT control deficiencies. However, 
during FY 2009, we continued to find control deficiencies related to IT general and application controls. 
The key deficiency from a financial reporting perspective relates to information security. Collectively, 
the IT control deficiencies limit CBP's ability to ensure that critical financial and operational data is 
maintained in such a manner to ensure confidentiality, integrity, and availability. Because of the sensitive 
nature of the issues identified, we will issue a separate restricted distribution report that discusses the 
control deficiencies in more detail. 

Criteria: 

The Federal Information Security Management Act (FISMA), passed as part of the E-Gov Act of 2002, 
mandates that Federal entities maintain IT security programs in accordance with OMB and the U.S. 
Department of Commerce. OMB Circular No. A- 130, Management of Federal Information Resources, 
and various National Institute of Standards and Technology (NIST) guidelines describe specific essential 
criteria for maintaining effective general IT controls. In addition, OMB Circular No. A- 127, Financial 
Management Systems, prescribes policies and standards for executive departments and agencies to follow 
in developing, operating, evaluating, and reporting on financial management systems. 

Recommendation: 

We recommend that CBP improve the application and general controls over its financial systems to 
ensure adequate security and protection of the information systems. 

CBP Response: 

See management's response included in the attached letter. 
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Status of Prior Year Material Weaknesses and Significant Deficiencies 



Prior Year Condition 


As Reported at 
September 30, 2008 


Status as of September 30, 2009 


Financial Reporting - 
Property, Plant, and 
Equipment (PP&E) 


Significant deficiency: Several 
weaknesses existed related to PP&E such 
as accounting for the Secure Border 
Initiative and the untimely transfer of 
construction in progress to fixed assets. 


Material Weakness: 

Weaknesses continue to exist 
related to the Secure Border 
Initiative and untimely transfer of 
construction in progress to fixed 
assets. In conjunction with 
additional deficiencies in control 
findings A-B, financial reporting 
and PP&E are both identified as 
a material weakness in fiscal year 
2009. 


Drawback of Duties, Taxes 
and Fees 


Material weakness: ACS lacked controls 
to detect and prevent excessive drawback 
claims and payments, requiring inefficient 
manual processes to compensate and the 
drawback review policies did not require 
drawback specialists to review all related 
drawback claims. 


Continue as a material 
weakness: Weaknesses continue 
to exist related to the drawback 
process in fiscal year 2009. See 
control finding letter C. 


Financial Reporting - 
Inactive Obligations 


Significant deficiency: Weaknesses in 
CBP's policies and procedures related to 
the timely deobligation of inactive 
obligations. 


Continue as a significant 
deficiency: Weaknesses 
continue to exist related to the 
timely deobligation of inactive 
obligations. See control finding 
letter D. 


Entry Process - In Bond 


Significant deficiency: Several 
weaKiiesseb exiaieu leiaieu 10 111-uoiiu such 
as the lack of official guidance and training 
to address the monitoring of in-bond 
shipments at the port level, lack of CBP- 
HQ review of the in-bond program, and the 
overall inability to determine the 
effectiveness of the in-bond program for 
CBP in its entirety. 


Continue as a significant 
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improvements were made, 
weaknesses still remain during 
fiscal year 2009. See control 
finding letter E, section 1. 


Entry Process - Entry 
Summary Compliance 
Measurement 


kMguiiicdui ueiicieucy. oeverai 
weaknesses existed related to Entry 
Summary Compliance Measurement, such 
as inconsistent procedures followed at the 
ports, lack of NTCB (formally NASD) port 

audits and littlp tpvipw cvr analv^i^ on tnp 
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ESCM data to ensure that it was input 
correctly. 
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deficiency: Although 
improvements were made, 
weaknesses still remain during 
fiscal year 2009. See control 

finding Ipttpr P *;pption 9 
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Entry Process - Bonded 
Warehouse and Foreign 
Trade Zones 


Significant deficiency: Several 
weaknesses existed related to BW/FTZ, 
such as the lack of official guidance and 
training to address the monitoring of 
BW/FTZ, and lack of management review 


Continue as a significant 
deficiency: Weaknesses continue 
to exist related to the bonded 
warehouse and foreign trade zone 
process during fiscal year 2009. 



Exhibit III 



Prior Year Condition 


As Reported at 
September 30, 2008 


Status as of September 30, 2009 




of the BW/FTZ surveys. 


See control finding letter E, 
section 3. 


Information Technology 


Significant deficiency: Weaknesses 
were noted in entity- wide security, 
system access, segregation of duties, 
service continuity, and system software 
change management. 


Continue as a significant 
deficiency: Weaknesses continue 
to exist related to IT general and 
application controls during fiscal 
year 2009. See control finding 
letter F. 


Non-compliance with the 

Federal Information 
Security Management Act 


Instance of non-compliance: CBP was not 

in substantial compliance with FISMA. 
FISMA requires the head of each agency to 
be responsible for 1) providing information 
security protections commensurate with the 
risk and magnitude of the harm resulting 
from unauthorized access, use, disclosure, 
disruption, modification, or destruction of 

(i) information collected or maintained and 

(ii) information systems used or operated; 
2) complying with the requirements of the 
Act and related policies, procedures, 
standards, and guidelines, including (i) 
information security standards under the 
United States Code, Title 40, Section 11331 
and (ii) information security standards and 
guidelines for national security systems; 
and 3) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning 
processes. 


Compliance is determined at 
the Department level. 


Non-compliance with the 

Federal Financial 
Management Improvement 
Act of 1996 


Instance of non-compliance: CBP was 

not in substantial compliance with FFMIA, 
which requires that an agency's financial 
management systems substantially comply 
with Federal financial management systems 
requirements, applicable Federal 
accounting standards, and the United States 
Government Standard General Ledger at 
the transaction level. We noted instances of 
non-compliance with FFMIA in relation to 
Federal financial management systems 
requirements and the United States 
Government Standard General Ledger at 
the transaction level. 


Compliance is determined at 
the Department level. 
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MEMORANDUM FOR: 



Inspector General 

Department of Homeland Security 



FROM: 



Eugene H. Schied 

Chief Financial Officer 

U.S. Customs and Border Protection 



SUBJECT: 



Management Response to Independent Auditor's Report on U.S. 
Customs and Border Protection's Fiscal Year 2009 Financial 
Statements 



On behalf of U.S. Customs and Border Protection (CBP), I am responding to the Independent 
Auditor's Report on CBP's Fiscal Year (FY) 2009 Financial Statements, which is included in our 
FY 2009 Performance and Accountability Report. 

I accept the independent public accounting firm, KPMG LLP's, unqualified opinion on CBP's 
FY 2009 Financial Statements, which concluded that CBP's consolidated financial statements 
are fairly presented in all material respects in conformity with accounting principles. 

CBP has reviewed and concur with the three material weaknesses as well as the three significant 
deficiencies. Mission Action Plans (MAPs) outlining CBP's strategy to correct these conditions 
will be prepared and provided to the DHS Office of Financial Management. CBP will continue 
to work to resolve all auditor identified weaknesses. 

CBP appreciates the opportunity to review this year's audit report and looks forward to 
continuing our professional auditing relationship with your office. If you have any questions or 
would like additional information, please contact me at (202) 344-2300, or a member of your 
staff may contact Mari Boyd, Executive Director, Financial Operations at (202) 344-2364. 




Eugene H. Schied 
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Appendix A 
Report Distribution 



Department of Homeland Security 

Secretary 

Deputy Secretary 

Chief of Staff for Operations 

Chief of Staff for Policy 

Deputy Chiefs of Staff 

General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief Financial Officer 

Chief Information Officer 

Customs and Border Protection 

Commissioner, Customs and Border Protection 
Chief Financial Officer 
Chief Information Officer 

Office of Management and Budget 

Chief, Homeland Security Branch 
DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 
appropriate 



ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



